Issue Mail queue very slow with 10 min delay

[apis]

Server operating system version

CentOS Linux 7.9.2009

Plesk version and microupdate number

Plesk Obsidian Web Host Edition 18.0.68 Aggiorna #1

Hi All,

i'm having an issue with my plesk server, since few weeks my mail queue has become extremely slow.
Looking for this issue in the forum i've already tried to disable greylisting, uninstalling the known extensions that are currently having problems but the issue persist.
The only thing that i notice is that if there are some mail in the queue after about 10 minutes they are processed.

My plesk version is Plesk Obsidian Web Host Edition 18.0.68 Update #1, runnning on a CentOs 7.
My mail server uses Postfix and Courier-IMAP.

Does some can help me?

Thanks.

 

[AYamshanov]

Is there anything helpful in logs? Have you tried to check details for a delayed email with the Log Browser extension? How many messages do you have in the mail queue?

 

[apis]

i've read the maillog, there are many message (like one every 30s) saying "NOQUEUE: reject: ... User unknown in virtual mailbox", all this mails to domains that i own but to invented accounts.
Then there are some messages of barracauda and spamcop blocking some mails but i think it's fine.
The number number of the mail depends, in working hours i've like 70-80 mails, at night it's 0 but usually it's always empty.
are the any particular log that i need to read?

 

[AYamshanov]

Does it happen with incoming or outgoing messages? I would suggest to send an email, check its details with the Log Browser extension (or try to grep all log records for the email by using its id). I believe it makes sense to find all stages email passed with timestamps. If delay is happened because of external delivery, then it makes sense to research how it is delivered out of Plesk, where it is stuck. It also makes sense to check email headers, they have timestamps and details regarding route, how it was delivered.

 

[apis]

i'm using plesk only to recive at the moment.
I follow the message ID with grep, there is an excacly 10 minutes delay from line "dmarc..." to line "spam...", screen shot in attachment.
is there something strange?

 

[Raul A.]

Is graylisting enabled?

 

[apis]

now, yes it is, but if i disable it it's the same, just more spam coming in.

 

[Raul A.]

Interesting. Check what you have, if anything, after the last line with the queueId at 17:41

grep "20 Mar 17:41" /var/log/maillog

 

[AYamshanov]

Interesting,
Sound like Issue - Postfix delivery delays with exact 600 seconds.

On your screenshot `delay=613`, but some time was spent before "spam: stderr: PASS".
If you use spamassassin (or other solutions), try to exclude them from delivery chain to identify the place of the issue.

Expand/Collapse Block: Just an example of how detailed log looks like on my test server

[...]
Mar 20 17:34:05 panel postfix-local[2761909]: 586073FFC4: dmarc: stderr: PASS
Mar 20 17:34:05 panel spamd[2609558]: spamd: connection from ::1 [::1]:45570 to port 783, fd 5
Mar 20 17:34:05 panel spamd[2609558]: spamd: using default config for [email protected]: /var/qmail/mailnames/example.org/example/.spamassassin/user_prefs
Mar 20 17:34:05 panel spamd[2609558]: spamd: processing message <CABxNv_x-yj9F=fu+Bs4RhkCFg2ORyfVqiEn_XNuB4Jt0Mj5F2A@mail.gmail.com> for [email protected]:30
Mar 20 17:34:07 panel spamd[2609558]: spamd: clean message (1.3/7.0) for [email protected]:30 in 1.6 seconds, 9270 bytes.
Mar 20 17:34:07 panel spamd[2609558]: spamd: result: . 1 - DKIM_SIGNED,DKIM_VALID,HTML_IMAGE_ONLY_24,HTML_MESSAGE,RCVD_IN_DNSWL_NONE scantime=1.6,size=9270,[email protected],uid=30,required_score=7.0,rhost=::1,raddr=::1,rport=45570,mid=<CABxNv_x-yj9F=fu+Bs4RhkCFg2ORyfVqiEn_XNuB4Jt0Mj5F2A@mail.gmail.com>,autolearn=no autolearn_force=no
Mar 20 17:34:07 panel postfix-local[2761909]: 586073FFC4: spam: stderr: PASS
[...]

 

[apis]

@Raul : if i've understood what you're asking me, the last line of this command is "server courier-po3disconnected, ..." and it writes it every time it passes a message

@AYamshanov : I've spamassasin active in the mail setting, how can i exclude them as you say?

​

 

[AYamshanov]

Just try to disable it, if delay disappear, it means need to dig into spamassassin.

SpamAssassin Spam Filter

The SpamAssassin spam filter identifies spam messages among emails sent to mailboxes hosted on your Plesk server.

docs.plesk.com

 

[apis]

ok, i've looked at the guide and i brought the SA_MAX_MAIL_SIZE from the default value to 150000.
if this doesn't solve the issue i'll try to disable spamassasin.
are there any other ways to dig into spamassasin besides the guide you linked me? i can't find in the control panel where to check the resources used by spamassasin now.

 

[apis]

i've found another thing, maybe connected to my issue: Mar 20 23:41:44 server spamd[28823]: spamd: server killed by SIGTERM, shutting down.

what is its meaning? can it be usefull for my issue?

 

[Raul A.]

Spamassassin was stopped. Perhaps restarted. Check /var/log/plesk/modules/monit if it was restarted by Plesk Watchdog.

Spassassin logs are in /var/log/maillog.

Check if Spamassassin was killed by OOM events.

grep -iE "OOM|kill" /var/log/messages

 

[apis]

this is what i've got from this: "grep -iE "OOM|kill" /var/log/messages"
the spamassasin deamon restarted many times this night until it got an update.
anyway this update does not solve the issue.

"/var/log/plesk/modules/monit" says "no such file or directory" instead.

 

[apis]

@AYamshanov editing the max size does not solve the issue, i tried to disable spamassasin and it stars working well, queue very fast.
Then I enable again spamassasin and it has worked well for about 15 minutes, now it is still in slow mode.

​

 

[AYamshanov]

Ok, then the issue somewhere near the SpamAssassin, it is a small step forward. But we need more info to understand what is happened during 10 mins,
As an example, you can enable logging for SpamAssassin and check what is happened in more details (see Resolved - Spamassassin details in logs?).
Does your server have enough resources (memory, disk, cpu)?

 

[apis]

is there a way to catch only the logs linked with one message?
in the resourses used windows there is no heavy load.

 

[AYamshanov]

Probably, like Raul A. suggested previously (Issue - Mail queue very slow with 10 min delay), by using grep, date, and maybe the process id.

By the way, since the issue takes so many time to resolve it, maybe it is a good moment to consider ability to contact the Plesk Support team.

 

[apis]

maybe I found something in the spamassasin.log, there a line saying: "warn: plugin: eval failed: bayes ... cannot create tmp lockfile ..." what do you think?